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STRESS & HACKING 



bla^hat* 

USA SD1S 


Just before this talk: 

Holding on for Tonight: Addiction in InfoSec 


Now: 

Stress and Hacking: Understanding Cognitive Stress 
in Tactical Cyber Operations 


This afternoon: 

Mental Health Hacks: Fighting Burnout, Depression 
and Suicide in the Hacker Community 


Tomorrow morning: 

Demystifying PTSD in the Cybersecurity Environment 



Let’s talk about stress. 















TYPES OF STRESS 


ACUTE Temporary ‘fight or flight’ response 


EPISODIC Repetitive stress with little time to recover 




























WHY IS HACKING SO STRESSFUL? 


COMPLEX 

UNPREDICTABLE 


HIGH RISK / REWARD 



STUDYING STRESS 


• Hard to study 

• Multi-faceted 

• Dependent on environment 

• Very subjective 




FATIGUE Physical and mental feeling of tiredness 


FRUSTRATION Anxiety and annoyance over lack of control 


COGNITIVE 

WORKLOAD 


Amount of mental effort needed to use memory 



FATIGUE 

Samn-Perelli Fatigue Scale 


Fatigue: How awake or tired are you before the operation? 



Fully alert, Very responsive, Okay, somewhat A little tired, less Moderately tired. Extremely tired, very Exhausted, unable to 
wideawake. but not at peak. fresh than fresh. letdown. difficult to concentrate, function effectively 





FRUSTRATION & COGNITIVE WORK 

NASA Task Load Index (TLX) 


Very Low Very High 

Mental Demand: How mentally demanding was the operation? 

Physical Demand: How physically demanding was the operation? 

Time Demand: How hurried or rushed was the pace of the operation? 

Overall Performance: How successful were you in accomplishing what you were asked to do? 
Frustration Level: How insecure, discouraged, irritated, stressed, and annoyed were you? 
Effort: How hard did you have to work to accomplish your level of performance? 






BASELINE 

Normalizing Individual Differences 


Fatigue: How awake or tired are you before the operation? 



Fully alert, Very responsive, Okay, somewhat A little tired, less Moderately tired. Extremely tired, very Exhausted, unable to 
wideawake. but not at peak. fresh than fresh. letdown. difficult to concentrate, function effectively 


Fatigue: How awake or tired are you after the operation? 



Fully alert. Very responsive. Okay, somewhat A little tired, less Moderately tired. Extremely tired, very Exhausted, unable to 
wideawake. but not at peak. fresh than fresh. letdown. difficult to concentrate, function effectively 







BASELINE 

Normalizing Individual Differences 


Frustration Level: How insecure, discouraged, irritated, stressed, and annoyed are you? 


Very Low Very High 


Frustration Level: How insecure, discouraged, irritated, stressed, and annoyed were you? 


Very Low 


Very High 







Cyber Operations Stress Survey 
PRE-OP: Complete this part before you start the operation 


Name or Participant ID: 

Date: 

What time did you arrive at the office today? 

When was your last operation? 


Operation type or goal: 


j Study-specific questions can be added as needed... 


Fatigue: How awake or tired are you before the operation? 

I I I I I I I I I I I I I I I I I I I 

Fully alert. Very responsive, Okay, somewhat A little tired, less Moderately Extremely tired, Exhausted, unable 
wideawake. but not at peak. fresh. than fresh. tired, let down, very difficult to to function 

concentrate. effectively. 

Frustration Level: How insecure, discouraged, irritated, stressed, and annoyed are you right 
now? 

1 [ I I I I I I I I I I I I I I 

Very Low Very High 


ir Complete this section only if you have never completed a version of this survey before: 



Complete the back page after the operation is complete 


Cyber Operations Stress Survey 
POST-OP: Complete this part after you complete the operation 


Operation end time: 


Fatigue: How awake or tired are you after the operation? 




Fully alert. Very responsive. Okay, somewhat A little tired, less Moderately Extremely tired. Exhausted, unable 
wideawake. but not at peak. fresh. than fresh. tired, let down, very difficult to to function 

concentrate. effectively. 


Mental Demand: How mentally demanding was the operation? 

' I I I I I I I I I I 


nn 


Very Low 

Physical Demand: How physically demanding was the operation? 


Very High 


I 


Very Low 

Time Demand: How hurried or rushed was the pace of the operation? 


Very High 


HE 


Very Low Very High 

Overall Performance: How successful were you in accomplishing what you were asked to do? 


HE 


Very Low Very High 

Frustration Level: How insecure, discouraged, irritated, stressed, and annoyed were you? 

I I I ' I I I I I I I I I I I IHH 

Very Low Very High 

Effort: How hard did you have to work to accomplish your level of performance? 

I I I I I I I I I I I I I I I r 

Very Low Very High 

Team Synergy: How well did your team work together? 


rn 1 1 1 1 1 1 1 1 1 1 1 1 

1 1 1 1 

1 1 

Very Low 


Very High 

1 Did you complete your objective? | DYes 

1 DNo 


Is there anything else you would like to tell us? 





















































































































































































































































PARTICIPANTS 


4 NSA Locations 
126 Tactical Cyber Operators 
361 Operation Surveys 
Both CIV and MIL* 



RESULTS 


Tactical Cyber Operations cause stress. 



FATIGUE 



O 


Pre-operation Post-operation 








FRUSTRATION 



O 


Pre-operation Post-operation 







COGNITIVE WORKLOAD 



o H 


Mental Physical Time Performance Effort 



Frustration 


RTLX = 44.5 (SD = 28.1) 












Is this a lot? 


Hint: That’s not the right question. 



COGNITIVE WORKLOAD 


Mental 

Physical .479* Physical 


Time 

.547* 

.541* 

Time 



Performance 

-.034 

-.012 

-.022 

Performance 


Effort 

.686* 

.486* 

.509* 

-.009 

Effort 

Frustration 

.468* 

.334* 

.429* 

-.315* 

.469* Frustration 


* p < .001 



FATIGUE & FRUSTRATION 



Mental 

Physical 

Time 

Performance 

Effort 

Frustration 

AFatigue 

.263* 

.225* 

.162* 

-.078 

.227* 

.173* 

L. 

AFrustration 

.238* 

.194* 

.201* 

-.184* 

.277* 



* p < .01 








OPERATION LENGTH 



Mental 

Physical 

Time 

Performance 

Effort 

Frustration 

Operation 

Length 

.376* 

.253* 

.27r 

.032 

.296* 

.176* 


* p < .001 




OPERATION LENGTH 


Operation 

Length 


AFatigue 

.361* 

* p < .001 


AFrustration 

. 210 * 


< 5 Hours A10% > 5 Hours 




Failure is not an option. 



Locus of control. 

The extent to which a person feels that they have 
control over the outcome of events in their lives. 



Fatigue: How awake or tired are you before the operation? 


Fully alert. Very responsive. Okay, somewhat A little tired, less Moderately Extremely tired, very Exhausted, unable to 

wide awake. but not at peak. fresh. than fresh. tired, let down, difficult to concentrate. function effectively. 


Frustration Level: How insecure, discouragedj^rritateg^tresse^ an^^noy§tf are you right now? 


Very Low 


Very High 




Significantly 
dropped after 
the operation! 












































SUMMARY 


Tactical cyber operations increase fatigue, frustration, and cognitive work 
Longer operations are more tiring, frustrating, and mentally demanding 
Fatigue and frustration begin to compound after 5 hours 


However, operators always pull through with performance, but at what cost? 



TAKEAWAYS 


Use the Cyber Operations Stress Survey to evaluate your own operations 
Review policies on breaks, scheduling, and operation length 
Empower operators with happy, healthy work environments 






Understancling Operator Fatigue, Frustration, and Cognitive Workload in 
Tactical Cybersecurits' Operations 
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Abstract: nhile the human factors of mission critical systems such as air traffic control and 
weapons systems have been extensively studied, there has been little work on cyber operations. 
As with any system, the perfect storm of complex tasks in a high-risk environment takes an 
incredible toll on human operators, leading to errors, decreased performance, and burnout. An 
extensive study of tactical cyber operations at the National Seaoity' Agency found that operator 
fatigue, frustration, and cognitive worldoad significantly increase aver the course of an 
operation. A discussion of these findings helps us understand the impact that the high-stress, 
high-risk environment of tactical cyber operations has on its operators. 

Kewords: Olw Operations. Cognitive Workload. Fatigue. Frustration. Burnout, Human 
Factors, Cy bmeairity 


Introduction 

C>tcrsecunty operations arc a mission-cntical service for die safety and business continuity of 
companies and organizations m the digital world From red team network penetration testing to 
real-tune defensivt monitoring. evx>h’ing technologs' and threats to the network make 
cytersecunty operations high-vahie. complex, and difficult This environment is considerably 
high-nsk. and success or &ilure can greatly affect the rmssioo or reputation of an organizatioo 
Research and development for cybersecurity' operations has heavily focused on technological 
means of achieving a more secure enlerpnse However, it is the human expens who play the 
most cntical role m the deployment. configuratioiL monitoring, and operation of networks 

The National Secunty Agency (NSA) coordmates. directs, and performs highly specialized 
activities to protect U S government information systems and to produce foreign signals 
mtelhgence One of NSA s missions is to defend the Department of Defense Information 
Network (DODIN). National Secunty Systems (NSS). and other cntical U S government 
systems Intelhgence analysts and network operators work together around the clock to detect, 
assess, and prevent foreign threats to nemxirks In addition to its beadquaners m Marv’land. 
NSA has cryptologic centers m Colorado. Georgia. Hawau. and Texas that also conduct foreign 
signals mteUigence. cyberspace operations, and information assurance operations 

NSA recruits and hues confer network operators to both defend U S mihtary* netw*orks and 
to exploit the networks of foreign adversaries For these jobs. NSA seeks people uith 
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Journal of Information Warfare (2017). 
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C'vIkt Opi‘rut ions Sli\‘ss Survey (COSSl; Sludvinu futiuiK*. ^^l^trution. and 
vvorkbiad in cyherM.*ciiritv operations 
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.Abstract 

Operator stress is a ccunmon. pemsieni. and dtsahhng 
cITect of cy ber operattuns and an impoftani risk factor 
for performance, safely, and emptoyee bumouL We de¬ 
signed the Cyber Operations Stress Survey (COSS) as 
a kM -cost method for stuch ing fatigue. fnistrMwn. and 
cognitive vorfcload in real time tactical cyber opentiom. 
The combinatkin of pre- and posl-operabonal measures 
with well vaJidafed factors from the NASA Task liiad 
Index and additional conlexiual facton provide a quick, 
easy, and valuable asaessmeni of cognitive stress. We 
repon on our expenenoes developing and fiekfang the 
survey instrunieni. validation, and desenhe the use and 
results of the COSS in four studies of cyber opentiotu 
aemss the National Security Agency. 

I InlnMluclion 

Cybersecuri^ Is a high-nsk. high reward profession that 
can negatriviy impact a company's fechnkral workforce. 
WMIe considerable researeh ha.s helped evaloaie and im- 
prme technology resiliency, htmufi resihency has been 
understudied de^Nfe the unportani role of humans in the 
design and execution of cyhersecuniy programs (4|. In 
this p^er. we fexus on a complimenlaiy goal of mea¬ 
suring human distress which can severely impact opera¬ 
tional effectneness and human health in particular, we 
offer a new researeh lastnimeni for measuring and as- 
sessiitg stress In lacticai cyber operfeionx 
Over the past decade, cyhersecunty operations h»e 
greatly maured Security monitoring in many organt- 
/aborol eiwironments occurs internally and as a man¬ 
aged service. Security Operations Centers (SOCi) offer 
one example of this, wiicre dedteafed security learns per¬ 
form threat moiMonng. investigation, mitigauon. and re¬ 
sponse to secunty events. Tas^ m the SOC require vig¬ 
ilance of changing threats, increasing volume of alerts, 
and incompfeie monitoring. Other than extraordtnary 


arcumstances. such as the disawery of an attack in 
progress le.g.. dutnhuied dental-of-seivice) or the du- 
covery of a setuitbc data breach defensive operations 
typically lack signibcant lime pressure. 

Tactical cyber oprratloav We distmgutsh a subset 
of cyber operations called toctiatl cyber oprraiiotu. in 
whi^ cyber capabilities are used to achieve specihe ef¬ 
fects on a network. Capture the flag games for militarv 
flierclses such as L'SCYBKRCOM's annual CVhcr Hag 
event ret an example of this lyjv of work (18}. Another 
aaraple is red team pcnetntioa testing, where an inde¬ 
pendent group play s the advetsarul role and ‘attacks' an 
orgamratkin to lest that argani/aikin's defenses. 

Thcbcal cyber operations are unique in several re- 
specu. Performance is highly dependent on speed and 
precision, just as it is for hghier pilots and surgeons The 
longer opentioo. the greater the risk, such as increased 
likelihood of uninrended defection on the network. Tac¬ 
tical operators require specsall/ed skills and traits Por 
aamples. peneiraiiaa testers havv a breadth of exper- 
Ure IB network and software fundaroenialv. reconnais¬ 
sance. apMiation. and adversarial thinking. Training 
for Alls type of work b extensive, expensive, and em¬ 
ployee turnover b costly The health of your laleai b as 
much of a risk management issue as it is a human re- 
Bsuroes issue. 

Why we rare about stress. A key motivation for this 
work is the intuition that stress neg^eiy affects oper¬ 
ational recuniy. work performance, and employee salis- 
faetkm. Tasks that imolve attention, memory, and visual 
perception result in high leveb of cogniitve demand and 
fatigue. There Is a strong conoectian between fatigue 
and stress |2I). and fatigue and task perfivmance |I2|. 
Wie know that stress negatively affecu cognitive abilities, 
task effeetbeDess. and general well-being. These types 
of effecu are harmful to high-nsk. mbsion-crilicai eiivi- 
ronmenis w here failure has great consequence. Stress is 
detnmenial to w ork that requires creatne problem solv ¬ 
ing —a skill that cyber opemors mhereiuiy require. 


Cyber Security Experimentation and Test (2018). 
https://www.usenix.org/conference/cset18/presentation/dykstra 
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